1 /*********************************************************************** 2 * 3 * common.c 4 * 5 * Implementation of user-space PPPoE redirector for Linux. 6 * 7 * Common functions used by PPPoE client and server 8 * 9 * Copyright (C) 2000 by Roaring Penguin Software Inc. 10 * 11 * This program may be distributed according to the terms of the GNU 12 * General Public License, version 2 or (at your option) any later version. 13 * 14 ***********************************************************************/ 15 16 static char const RCSID[] = 17 "$Id: common.c,v 1.2 2004/01/13 04:03:58 paulus Exp $"; 18 19 #include "pppoe.h" 20 21 #ifdef HAVE_SYSLOG_H 22 #include <syslog.h> 23 #endif 24 25 #include <string.h> 26 #include <errno.h> 27 #include <stdlib.h> 28 29 #ifdef HAVE_UNISTD_H 30 #include <unistd.h> 31 #endif 32 33 /********************************************************************** 34 *%FUNCTION: parsePacket 35 *%ARGUMENTS: 36 * packet -- the PPPoE discovery packet to parse 37 * func -- function called for each tag in the packet 38 * extra -- an opaque data pointer supplied to parsing function 39 *%RETURNS: 40 * 0 if everything went well; -1 if there was an error 41 *%DESCRIPTION: 42 * Parses a PPPoE discovery packet, calling "func" for each tag in the packet. 43 * "func" is passed the additional argument "extra". 44 ***********************************************************************/ 45 int 46 parsePacket(PPPoEPacket *packet, ParseFunc *func, void *extra) 47 { 48 UINT16_t len = ntohs(packet->length); 49 unsigned char *curTag; 50 UINT16_t tagType, tagLen; 51 52 if (packet->ver != 1) { 53 syslog(LOG_ERR, "Invalid PPPoE version (%d)", (int) packet->ver); 54 return -1; 55 } 56 if (packet->type != 1) { 57 syslog(LOG_ERR, "Invalid PPPoE type (%d)", (int) packet->type); 58 return -1; 59 } 60 61 /* Do some sanity checks on packet */ 62 if (len > ETH_DATA_LEN - 6) { /* 6-byte overhead for PPPoE header */ 63 syslog(LOG_ERR, "Invalid PPPoE packet length (%u)", len); 64 return -1; 65 } 66 67 /* Step through the tags */ 68 curTag = packet->payload; 69 while(curTag - packet->payload < len) { 70 /* Alignment is not guaranteed, so do this by hand... */ 71 tagType = (((UINT16_t) curTag[0]) << 8) + 72 (UINT16_t) curTag[1]; 73 tagLen = (((UINT16_t) curTag[2]) << 8) + 74 (UINT16_t) curTag[3]; 75 if (tagType == TAG_END_OF_LIST) { 76 return 0; 77 } 78 if ((curTag - packet->payload) + tagLen + TAG_HDR_SIZE > len) { 79 syslog(LOG_ERR, "Invalid PPPoE tag length (%u)", tagLen); 80 return -1; 81 } 82 func(tagType, tagLen, curTag+TAG_HDR_SIZE, extra); 83 curTag = curTag + TAG_HDR_SIZE + tagLen; 84 } 85 return 0; 86 } 87 88 /********************************************************************** 89 *%FUNCTION: findTag 90 *%ARGUMENTS: 91 * packet -- the PPPoE discovery packet to parse 92 * type -- the type of the tag to look for 93 * tag -- will be filled in with tag contents 94 *%RETURNS: 95 * A pointer to the tag if one of the specified type is found; NULL 96 * otherwise. 97 *%DESCRIPTION: 98 * Looks for a specific tag type. 99 ***********************************************************************/ 100 unsigned char * 101 findTag(PPPoEPacket *packet, UINT16_t type, PPPoETag *tag) 102 { 103 UINT16_t len = ntohs(packet->length); 104 unsigned char *curTag; 105 UINT16_t tagType, tagLen; 106 107 if (packet->ver != 1) { 108 syslog(LOG_ERR, "Invalid PPPoE version (%d)", (int) packet->ver); 109 return NULL; 110 } 111 if (packet->type != 1) { 112 syslog(LOG_ERR, "Invalid PPPoE type (%d)", (int) packet->type); 113 return NULL; 114 } 115 116 /* Do some sanity checks on packet */ 117 if (len > ETH_DATA_LEN - 6) { /* 6-byte overhead for PPPoE header */ 118 syslog(LOG_ERR, "Invalid PPPoE packet length (%u)", len); 119 return NULL; 120 } 121 122 /* Step through the tags */ 123 curTag = packet->payload; 124 while(curTag - packet->payload < len) { 125 /* Alignment is not guaranteed, so do this by hand... */ 126 tagType = (((UINT16_t) curTag[0]) << 8) + 127 (UINT16_t) curTag[1]; 128 tagLen = (((UINT16_t) curTag[2]) << 8) + 129 (UINT16_t) curTag[3]; 130 if (tagType == TAG_END_OF_LIST) { 131 return NULL; 132 } 133 if ((curTag - packet->payload) + tagLen + TAG_HDR_SIZE > len) { 134 syslog(LOG_ERR, "Invalid PPPoE tag length (%u)", tagLen); 135 return NULL; 136 } 137 if (tagType == type) { 138 memcpy(tag, curTag, tagLen + TAG_HDR_SIZE); 139 return curTag; 140 } 141 curTag = curTag + TAG_HDR_SIZE + tagLen; 142 } 143 return NULL; 144 } 145 146 /********************************************************************** 147 *%FUNCTION: printErr 148 *%ARGUMENTS: 149 * str -- error message 150 *%RETURNS: 151 * Nothing 152 *%DESCRIPTION: 153 * Prints a message to stderr and syslog. 154 ***********************************************************************/ 155 void 156 printErr(char const *str) 157 { 158 fprintf(stderr, "pppoe: %s\n", str); 159 syslog(LOG_ERR, "%s", str); 160 } 161 162 163 /********************************************************************** 164 *%FUNCTION: strDup 165 *%ARGUMENTS: 166 * str -- string to copy 167 *%RETURNS: 168 * A malloc'd copy of str. Exits if malloc fails. 169 ***********************************************************************/ 170 char * 171 strDup(char const *str) 172 { 173 char *copy = malloc(strlen(str)+1); 174 if (!copy) { 175 rp_fatal("strdup failed"); 176 } 177 strcpy(copy, str); 178 return copy; 179 } 180 181 #ifdef PPPOE_STANDALONE 182 /********************************************************************** 183 *%FUNCTION: computeTCPChecksum 184 *%ARGUMENTS: 185 * ipHdr -- pointer to IP header 186 * tcpHdr -- pointer to TCP header 187 *%RETURNS: 188 * The computed TCP checksum 189 ***********************************************************************/ 190 UINT16_t 191 computeTCPChecksum(unsigned char *ipHdr, unsigned char *tcpHdr) 192 { 193 UINT32_t sum = 0; 194 UINT16_t count = ipHdr[2] * 256 + ipHdr[3]; 195 unsigned char *addr = tcpHdr; 196 unsigned char pseudoHeader[12]; 197 198 /* Count number of bytes in TCP header and data */ 199 count -= (ipHdr[0] & 0x0F) * 4; 200 201 memcpy(pseudoHeader, ipHdr+12, 8); 202 pseudoHeader[8] = 0; 203 pseudoHeader[9] = ipHdr[9]; 204 pseudoHeader[10] = (count >> 8) & 0xFF; 205 pseudoHeader[11] = (count & 0xFF); 206 207 /* Checksum the pseudo-header */ 208 sum += * (UINT16_t *) pseudoHeader; 209 sum += * ((UINT16_t *) (pseudoHeader+2)); 210 sum += * ((UINT16_t *) (pseudoHeader+4)); 211 sum += * ((UINT16_t *) (pseudoHeader+6)); 212 sum += * ((UINT16_t *) (pseudoHeader+8)); 213 sum += * ((UINT16_t *) (pseudoHeader+10)); 214 215 /* Checksum the TCP header and data */ 216 while (count > 1) { 217 sum += * (UINT16_t *) addr; 218 addr += 2; 219 count -= 2; 220 } 221 if (count > 0) { 222 sum += *addr; 223 } 224 225 while(sum >> 16) { 226 sum = (sum & 0xffff) + (sum >> 16); 227 } 228 return (UINT16_t) (~sum & 0xFFFF); 229 } 230 231 /********************************************************************** 232 *%FUNCTION: clampMSS 233 *%ARGUMENTS: 234 * packet -- PPPoE session packet 235 * dir -- either "incoming" or "outgoing" 236 * clampMss -- clamp value 237 *%RETURNS: 238 * Nothing 239 *%DESCRIPTION: 240 * Clamps MSS option if TCP SYN flag is set. 241 ***********************************************************************/ 242 void 243 clampMSS(PPPoEPacket *packet, char const *dir, int clampMss) 244 { 245 unsigned char *tcpHdr; 246 unsigned char *ipHdr; 247 unsigned char *opt; 248 unsigned char *endHdr; 249 unsigned char *mssopt = NULL; 250 UINT16_t csum; 251 252 int len, minlen; 253 254 /* check PPP protocol type */ 255 if (packet->payload[0] & 0x01) { 256 /* 8 bit protocol type */ 257 258 /* Is it IPv4? */ 259 if (packet->payload[0] != 0x21) { 260 /* Nope, ignore it */ 261 return; 262 } 263 264 ipHdr = packet->payload + 1; 265 minlen = 41; 266 } else { 267 /* 16 bit protocol type */ 268 269 /* Is it IPv4? */ 270 if (packet->payload[0] != 0x00 || 271 packet->payload[1] != 0x21) { 272 /* Nope, ignore it */ 273 return; 274 } 275 276 ipHdr = packet->payload + 2; 277 minlen = 42; 278 } 279 280 /* Is it too short? */ 281 len = (int) ntohs(packet->length); 282 if (len < minlen) { 283 /* 20 byte IP header; 20 byte TCP header; at least 1 or 2 byte PPP protocol */ 284 return; 285 } 286 287 /* Verify once more that it's IPv4 */ 288 if ((ipHdr[0] & 0xF0) != 0x40) { 289 return; 290 } 291 292 /* Is it a fragment that's not at the beginning of the packet? */ 293 if ((ipHdr[6] & 0x1F) || ipHdr[7]) { 294 /* Yup, don't touch! */ 295 return; 296 } 297 /* Is it TCP? */ 298 if (ipHdr[9] != 0x06) { 299 return; 300 } 301 302 /* Get start of TCP header */ 303 tcpHdr = ipHdr + (ipHdr[0] & 0x0F) * 4; 304 305 /* Is SYN set? */ 306 if (!(tcpHdr[13] & 0x02)) { 307 return; 308 } 309 310 /* Compute and verify TCP checksum -- do not touch a packet with a bad 311 checksum */ 312 csum = computeTCPChecksum(ipHdr, tcpHdr); 313 if (csum) { 314 syslog(LOG_ERR, "Bad TCP checksum %x", (unsigned int) csum); 315 316 /* Upper layers will drop it */ 317 return; 318 } 319 320 /* Look for existing MSS option */ 321 endHdr = tcpHdr + ((tcpHdr[12] & 0xF0) >> 2); 322 opt = tcpHdr + 20; 323 while (opt < endHdr) { 324 if (!*opt) break; /* End of options */ 325 switch(*opt) { 326 case 1: 327 opt++; 328 break; 329 330 case 2: 331 if (opt[1] != 4) { 332 /* Something fishy about MSS option length. */ 333 syslog(LOG_ERR, 334 "Bogus length for MSS option (%u) from %u.%u.%u.%u", 335 (unsigned int) opt[1], 336 (unsigned int) ipHdr[12], 337 (unsigned int) ipHdr[13], 338 (unsigned int) ipHdr[14], 339 (unsigned int) ipHdr[15]); 340 return; 341 } 342 mssopt = opt; 343 break; 344 default: 345 if (opt[1] < 2) { 346 /* Someone's trying to attack us? */ 347 syslog(LOG_ERR, 348 "Bogus TCP option length (%u) from %u.%u.%u.%u", 349 (unsigned int) opt[1], 350 (unsigned int) ipHdr[12], 351 (unsigned int) ipHdr[13], 352 (unsigned int) ipHdr[14], 353 (unsigned int) ipHdr[15]); 354 return; 355 } 356 opt += (opt[1]); 357 break; 358 } 359 /* Found existing MSS option? */ 360 if (mssopt) break; 361 } 362 363 /* If MSS exists and it's low enough, do nothing */ 364 if (mssopt) { 365 unsigned mss = mssopt[2] * 256 + mssopt[3]; 366 if (mss <= clampMss) { 367 return; 368 } 369 370 mssopt[2] = (((unsigned) clampMss) >> 8) & 0xFF; 371 mssopt[3] = ((unsigned) clampMss) & 0xFF; 372 } else { 373 /* No MSS option. Don't add one; we'll have to use 536. */ 374 return; 375 } 376 377 /* Recompute TCP checksum */ 378 tcpHdr[16] = 0; 379 tcpHdr[17] = 0; 380 csum = computeTCPChecksum(ipHdr, tcpHdr); 381 (* (UINT16_t *) (tcpHdr+16)) = csum; 382 } 383 #endif /* PPPOE_STANDALONE */ 384 385 /*********************************************************************** 386 *%FUNCTION: sendPADT 387 *%ARGUMENTS: 388 * conn -- PPPoE connection 389 * msg -- if non-NULL, extra error message to include in PADT packet. 390 *%RETURNS: 391 * Nothing 392 *%DESCRIPTION: 393 * Sends a PADT packet 394 ***********************************************************************/ 395 void 396 sendPADT(PPPoEConnection *conn, char const *msg) 397 { 398 PPPoEPacket packet; 399 unsigned char *cursor = packet.payload; 400 401 UINT16_t plen = 0; 402 403 /* Do nothing if no session established yet */ 404 if (!conn->session) return; 405 406 /* Do nothing if no discovery socket */ 407 if (conn->discoverySocket < 0) return; 408 409 memcpy(packet.ethHdr.h_dest, conn->peerEth, ETH_ALEN); 410 memcpy(packet.ethHdr.h_source, conn->myEth, ETH_ALEN); 411 412 packet.ethHdr.h_proto = htons(Eth_PPPOE_Discovery); 413 packet.ver = 1; 414 packet.type = 1; 415 packet.code = CODE_PADT; 416 packet.session = conn->session; 417 418 /* Reset Session to zero so there is no possibility of 419 recursive calls to this function by any signal handler */ 420 conn->session = 0; 421 422 /* If we're using Host-Uniq, copy it over */ 423 if (conn->useHostUniq) { 424 PPPoETag hostUniq; 425 pid_t pid = getpid(); 426 hostUniq.type = htons(TAG_HOST_UNIQ); 427 hostUniq.length = htons(sizeof(pid)); 428 memcpy(hostUniq.payload, &pid, sizeof(pid)); 429 memcpy(cursor, &hostUniq, sizeof(pid) + TAG_HDR_SIZE); 430 cursor += sizeof(pid) + TAG_HDR_SIZE; 431 plen += sizeof(pid) + TAG_HDR_SIZE; 432 } 433 434 /* Copy error message */ 435 if (msg) { 436 PPPoETag err; 437 size_t elen = strlen(msg); 438 err.type = htons(TAG_GENERIC_ERROR); 439 err.length = htons(elen); 440 strcpy(err.payload, msg); 441 memcpy(cursor, &err, elen + TAG_HDR_SIZE); 442 cursor += elen + TAG_HDR_SIZE; 443 plen += elen + TAG_HDR_SIZE; 444 } 445 446 /* Copy cookie and relay-ID if needed */ 447 if (conn->cookie.type) { 448 CHECK_ROOM(cursor, packet.payload, 449 ntohs(conn->cookie.length) + TAG_HDR_SIZE); 450 memcpy(cursor, &conn->cookie, ntohs(conn->cookie.length) + TAG_HDR_SIZE); 451 cursor += ntohs(conn->cookie.length) + TAG_HDR_SIZE; 452 plen += ntohs(conn->cookie.length) + TAG_HDR_SIZE; 453 } 454 455 if (conn->relayId.type) { 456 CHECK_ROOM(cursor, packet.payload, 457 ntohs(conn->relayId.length) + TAG_HDR_SIZE); 458 memcpy(cursor, &conn->relayId, ntohs(conn->relayId.length) + TAG_HDR_SIZE); 459 cursor += ntohs(conn->relayId.length) + TAG_HDR_SIZE; 460 plen += ntohs(conn->relayId.length) + TAG_HDR_SIZE; 461 } 462 463 packet.length = htons(plen); 464 sendPacket(conn, conn->discoverySocket, &packet, (int) (plen + HDR_SIZE)); 465 if (conn->debugFile) { 466 dumpPacket(conn->debugFile, &packet, "SENT"); 467 fprintf(conn->debugFile, "\n"); 468 fflush(conn->debugFile); 469 } 470 syslog(LOG_INFO,"Sent PADT"); 471 } 472 473 /********************************************************************** 474 *%FUNCTION: parseLogErrs 475 *%ARGUMENTS: 476 * type -- tag type 477 * len -- tag length 478 * data -- tag data 479 * extra -- extra user data 480 *%RETURNS: 481 * Nothing 482 *%DESCRIPTION: 483 * Picks error tags out of a packet and logs them. 484 ***********************************************************************/ 485 void 486 parseLogErrs(UINT16_t type, UINT16_t len, unsigned char *data, 487 void *extra) 488 { 489 switch(type) { 490 case TAG_SERVICE_NAME_ERROR: 491 syslog(LOG_ERR, "PADT: Service-Name-Error: %.*s", (int) len, data); 492 fprintf(stderr, "PADT: Service-Name-Error: %.*s\n", (int) len, data); 493 break; 494 case TAG_AC_SYSTEM_ERROR: 495 syslog(LOG_ERR, "PADT: System-Error: %.*s", (int) len, data); 496 fprintf(stderr, "PADT: System-Error: %.*s\n", (int) len, data); 497 break; 498 case TAG_GENERIC_ERROR: 499 syslog(LOG_ERR, "PADT: Generic-Error: %.*s", (int) len, data); 500 fprintf(stderr, "PADT: Generic-Error: %.*s\n", (int) len, data); 501 break; 502 } 503 } 504 505